NtObjectManager

1.0.7

This module adds a provider and cmdlets to access the NT object manager namespace.

Minimum PowerShell version

3.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name NtObjectManager -RequiredVersion 1.0.7

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deloy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Author(s)

James Forshaw

Copyright

(c) 2016, 2017 Google Inc. All rights reserved.

Owners

Tags

security defence offence sandbox

Cmdlets

Add-NtKey Get-NtDirectory Get-NtEvent Get-NtFile Get-NtFileReparsePoint Get-NtHandle Get-NtKey Get-NtMutant Get-NtNamedPipeFile Get-NtObject Get-NtProcess Get-NtSemaphore Get-NtStatus Get-NtSymbolicLink Get-NtSymbolicLinkTarget Get-NtThread Get-NtToken Get-NtType New-NtDirectory New-NtEvent New-NtFile New-NtKey New-NtMailslotFile New-NtMutant New-NtNamedPipeFile New-NtSecurityDescriptor New-NtSemaphore New-NtSymbolicLink Remove-NtFileReparsePoint Start-NtWait Use-NtObject Get-NtFilteredToken Get-NtLowBoxToken Get-NtSid Get-NtSection New-NtSection Get-AccessibleAlpcPort Get-AccessibleKey Get-AccessibleProcess Get-AccessibleFile Get-AccessibleObject Get-NtAccessMask Get-AccessibleDevice Get-AccessibleNamedPipe Get-NtGrantedAccess

Functions

Get-NtTokenPrimary Get-NtTokenThread Get-NtTokenEffective Get-AccessibleAlpcPort Set-NtTokenPrivilege Set-NtTokenIntegrityLevel

Dependencies

This module has no dependencies.

Release Notes

1.0.7
-----
* Added new cmdlets to do access checking. Many of the old standalone utilities are now deprecated.
* Added cmdlets to create lowbox tokens
* Added list of known capability SIDs and resolve them during name lookup
* Added cmdlet to get a SID
* Added cmdlet to do a standalone access checking
* Reworked the APIs to include non-throwing versions of many of the core Open/Create methods.
* Made NtType more inspectable, includes access enumeration and rationalizes the opening methods.
* Various additional properties such as extended process flags, checking for LPAC
* Rework of access mask handling. Now all low-level APIs use an AccessMask structure which has
 conversion operators to and from other enumerations.
* Various other bug fixes.
1.0.6
-----
* Added cmdlet to filter a Token object.
* Cleanups to various components to make them easier to use from PS
1.0.5
-----
* Added additional Known SIDs
* Unified the variant Get-NtToken* cmdlets into one.
* Added additional token cmdlets such as Logon and Clipboard.
* Added initial support for IO Completion Ports
* Added object creation time property
* Added support to set a process device map
* Added top level CanSynchronize property to NtObject
* Bugs fixes from Rustam Agametov
1.0.4
-----
* Support getting and setting file EA buffe
* Added cmdlet to get NTSTATUS code information
* Support to toggle UIAccess and Virtualization flags on tokens
* Added asynchronous support for file operations using Task APIs
* Added support for virtual memory functions
* Added cmdlet to create named pipes and mailslots.
* Added support for specifying SD as SDDL directly to cmdlets.
* Added thread descriptions for Anniversary edition and above.
1.0.3
-----
* Fixed small bug in handling of IO_STATUS_BLOCK which could result in memory corruption.
* Added support to list directory entries for a file directory.
* Added support to do basic read and writes to a file.
1.0.2
-----
* Added support to disable dynamic code policy on a process.
* Added cmdlets for reparse points.
* Fixes for EA buffer.
* Added service SIDs.
* Added support for removing token privileges.
* Fixed token security attribute parsing.
1.0.1
-----
* Fixed bug in Get-NtThread with -ProcessId
* Added support for FilterScript for Get-NtThread
* Added support for querying thread dynamic code opt-out policy
* Added support for RFG mitigation
1.0.0
-----
Initial release:
* NT Object Manager drive provider
* Cmdlets to directory work with Directorys, Files, Symbolic Links, Events, Semaphores, Processes, Threads, Tokens etc.

Version History

Version Downloads Last updated
1.1.17 277 9/9/2018
1.1.16 152 8/1/2018
1.1.15 174 6/18/2018
1.1.14 195 5/1/2018
1.1.13 91 4/4/2018
1.1.12 222 3/19/2018
1.1.11 67 3/4/2018
1.1.10 17 3/1/2018
1.1.9 46 2/22/2018
1.1.8 67 2/6/2018
1.1.7 78 1/11/2018
1.1.6 84 12/3/2017
1.1.5 28 11/23/2017
1.1.4 48 11/14/2017
1.1.3 34 11/5/2017
1.1.2 67 10/11/2017
1.1.1 100 8/30/2017
1.1.0 4 8/30/2017
1.0.9 68 8/19/2017
1.0.8 44 8/7/2017
1.0.7 (current version) 109 6/14/2017
1.0.6 173 5/24/2017
1.0.5 8 5/24/2017
1.0.4 20 5/17/2017
1.0.3 73 2/23/2017
1.0.2 27 2/8/2017
1.0.1 109 11/3/2016
1.0 72 11/1/2016
Show less